in reply to Re^7: MD5 - what's the alternative
in thread MD5 - what's the alternative

Due to the ability of Wang's method to produce MD5 compression function collisions for any IV, and due to the iterative structure of MD5, we can append a collision to any block of data of our choice (provided that the bitlength is a multiple of the MD5 block length), while maintaining the collision property. Similarly we can then append data of our choice to the constructed collisions. In this way we can build colliding certificates.

I don't know how much clearer it needs to be spelt out.

Makeshifts last the longest.

Replies are listed 'Best First'.
Re^9: MD5 - what's the alternative
by BrowserUk (Patriarch) on Mar 11, 2005 at 20:35 UTC
    (provided that the bitlength is a multiple of the MD5 block length)


    Examine what is said, not who speaks.
    Silence betokens consent.
    Love the truth but pardon error.
    Lingua non convalesco, consenesco et abolesco.